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This  report  reviews  the  work  which  Arthur  D.  Little,  Inc.,  has  been  doing  under  con¬ 
tract  DOT  FA70WA-2141  on  air  traffic  control  (ATC)  system  capacity,  and  explains  the 
course  which  this  work  is  expected  to  take  next  year.  The  material  was  ori^nally  assembled 
for  a  briefing  at  the  FAA  on  October  7, 1 97 1 ,  for  a  mixed  audience  of  FAA  representatives, 
contractors,  and  visitors.  Some  members  of  the  audience  had  been  steadily  following  the 
work  of  Arthur  D.  Little,  Inc.,  and  were  interested  in  a  comprehensive  progress  report 
summarizing  all  that  had  been  accomplished.  Others  have  particular  problems  related  to 
ATC  system  capacity,  and  were  interested  in  an  opportunity  to  apply  our  work  to  their 
problems.  Still  others  were  there  out  of  curiosity  and  for  geneial  information,  to  keep  them¬ 
selves  and  their  agencies  well  informed  about  what  is  going  on.  The  briefing  was  intended  to 
appeal  to  all  these  groups. 

The  discussion  is  oiganized  under  four  topics: 

1 .  Motivation  to  study  ATC  system  capacity, 

2.  The  role  of  .Arthur  D.  Little,  Inc., 

3.  Accomplishments  of  the  first  two  years  of  the  study,  and 

4.  Proposed  future  work. 

2.  MOTIVATION  TO  STUDY  ATC  SYSTEM  CAPACITY 

There  are  many  reasons  why  we  are  taking  a  look  at  ATC  system  capacity.  First,  there 
are  technical  and  operational  factors.  Some  elements  of  the  present  ATC  system  could  not 
function  satisfactorily  with  substantially  iiore  traffic.  All  predictions  forecast  growth  in  air 
transportation,  leading  to  larger,  faster,  and  more  numerous  aircraft.  New  types  of  aircraft, 
such  as  supersonic  transports  and  short-  or  vertical-take-off-and-landing  aircraft,  are  likely  to 
come  into  use.  New  technological  options,  such  as  inertial  navigation  systems,  satellite  sur¬ 
veillance,  and  automated  data  processing  are  within  reach. 

Second,  there  are  user  group  pressures.  The  operating  airlines,  both  individually  and 
through  the  Air  Transport  Association,  and  general  aviation  are  asking  for  improved  ATC 
services,  and  the  general  public  is  becoming  more  aware  of  the  role  of  air  traffic  control  in 
tlie  safety  and  efficiency  of  air  transportation.  Payment  of  user  charges  reinforces  the  legiti¬ 
macy  of  user  group  demands. 

Third,  there  are  political  and  administrative  demands.  We  need  only  mention  the 
CARD  Committee,  the  Brooks  Committee,  and  demands  which  arise  periodically  during  the 
budget  review  cycle. 


3.  THE  ROLE  OF  ARTHUR  D.  LITTLE,  INC. 


The  purpose  of  work  being  performed  by  Arthur  D.  Little,  Inc.  (ADL)  is  to  develop 
tools  for  the  Federal  Aviation  Administration  (FAA)  to  use  in  planning,  decision-making, 
and  evaluation  of  air  traffic  control.  If  this  sounds  too  abstract,  consider  an  example  of  the 
sort  of  question  which  the  FAA  must  answer  several  times  every  year:  given  two  alterna¬ 
tives  for  improving  the  performance  of  air  traffic  control  and  an  estimate  of  the  cost  of 
each,  which  will  assure  better  overall  air  transportation  system  performance  when  subjected 
to  the  increased  traffic  projected  for  the  near  future? 

The  initial  goals  of  work  being.performed  by  ADL  are: 

•  To  define  the  capacity  of  an  ATC  system  and  its  major  elements, 

•  To  find  quantitative  relations  between  capacity  and  the  overall 
performance  of  the  air  transportation  system,  and 

•  To  find  quantitative  relations  between  capacity  and  the  speci¬ 
fications,  operating  parameters,  and  environment  of  the  ATC 
system. 


4.  ACCOMPLISHMENT  IN  THE  FIRST  TWO  YEARS  OF  THE  STUDY 


A  necessary  preliminary  is  to  tind  out  how  the  FAA  operates,  to  learn  the  functions 
which  air  traffic  control  fulfills  for  industry,  the  public  and  national  defense,  and  to  learn 
how  air  traffic  control  relates  to  operations.  We  were  in  this  stage  during  much  of  our  first' 
year  of  activity,  but  now  we  are  in  a  position  to  apply  what  we  know  about  operations  re¬ 
search,  systems  analysis,  and  other  branches  of  science  and  technology  to  air  traffic  control. 
What  we  have  accomplished  is  described  below  under  five  principal  headings: 

1:  A  concept  of  capacity, 

2.  A  measure  of  safety, 

3.  Some  analytical  tools  based  on  queueing  theory, 

4.  An  analysis  of  system  functions  comprising  air  traffic  con  Irol  and 
a  description  of  system  parameters  related  to  capacity,  and 

5.  Applications  to  certain  cunent  FAA  problems. 

4.1  A  CONCEPT  OF  CAPACITY 

We  speak  of  the  “capacity”  of  a  component  of  the  air  transportation  system,  such  as  a 
terminal,  a  funway,  or  an  ATC  tower,  to  mean  -  in  a  general  way  -  how  much  traffic  it  can 
handle  when  fully  performing  its  task.  In  dealing  with  methods  of  increasing  this  capability 
under  conditions  of  future  rising  demand  -  and  by  means  of  expenave  equipment  ~  it  is 
important  to  go  beyond  this  general  notion:  “capacity”  must  be  defined  with  such  pre¬ 
cision  that  the  beneficial  effects  of  the  suggested  ijnprovements  can  be  measured  (or  com¬ 
puted). 

Military  operations  under  combat  conditions  have  shown  that  the  rate  of  launching  or 
recovery  of  aircraft  from  Air  Force  runways  or  from  aircraft  carriers  can  exceed  the  rate  for 
civilian  airports.  The  reason  for  this  increase  is  the  much  greater  risk  that  is  considered  ac¬ 
ceptable  in  military  operations.  This  illustrates  the  first  principle  in  giving  any  definition  of 
capacity:  the  degree  of  acceptable  risk  must  be  specified. 

During  rush  hour  traffic  large  air  terminals  can  accept  aircraft  temporarily  at  a  greater 
rate  than  they  can  permit  them  to  land,  provided  that  there  are  enough  stacking  spaces 
they  may  be  held  until  the  traffic  thins  out.  Conceptually,  any  number  of  aircraft  could  be 
accepted  by  increasing  the  holding  space  sufficiently.  To  increase  capacity  by  this  means  in¬ 
curs  delays,  which  increase  with  the  number  of  aircraft  held.  Thus,  we  have  a  further  illus¬ 
tration  of  the  first  principle  in  the  precise  definition  of  capacity:  the  degree  of  acceptable 
delay  must  be  specified. 


The  same  can  be  said  about  the  whole  spectrum  of  service  degradations:  cancellations, 
diversions,  passenger  comfort,  and  so  on.  Uncertainties  as  well  as  averages  figure  in  too:  an 
accurately  predicted  time  late  may  degrade  service  less  than  randomly  occurring  unexpected 
delays.  We  can  now  formulate  our  first  principle:  the  degree  of  acceptable  risk,  delay,  and 
all  other  significant  service  degradations  must  be  specified. 

Suppose,  then,  that  the  maximum  acceptable  risk,  delay,  and  other  service  degrada¬ 
tions  are  given  and  we  wish  to  define  capacity  under  these  restrictions.  A  further  complica¬ 
tion  is  encountered:  the  effect  of  the  variation  in  traffic  demand  during  the  course  of  the 
day  of  the  requests  for  landing  or  for  takeoff.  Consider,  for  example,  the  total  number  of 
aircraft  that  wish  to  land  at  an  air  terminal  during  a  24-hour  day.  If  they  arrive  at  an  even 
rate  (e.g.,  the  siime  number  per  quarter  hour  during  the  24),  a  much  greater  number  could 
be  accommodated  than  if  their  arrivals  (or  requests  for  arrival)  are  highly  peaked;  they  can¬ 
not  all  be  accommodated  without  holding  delays  which  exceed  the  established  limits.  Thus 
we  are  led  to  the  second  principle  governing  any  exact  definition  of  capacity:  the  ability  to 
handle  the  demand  will  depend  on  the  demand  profile,  i.e.,  the  rate  of  requests  for  service 
and  the  character  of  the  service  requested,  plotted  as  a  function  of  time. 

The  third  and  final  principle  governing  any  definition  of  capacity,  if  it  is  to  be  at  the 
same  time  precise  and  realistic,  is  that  it  must  be  stated  in  terms  of  probability  parameters 
(statistical  quantities  such  as  means,  standard  deviations,  etc,).  This  is  because  no  situation 
involving  the  handling  of  aircraft  under  “real  life”  conditions  can  ever  be  free  from  random. 
It  is  highly  appropriate  to  try  to  reduce  it  as  much  as  possible  to  regularity:  but  this  very 
process  requires  the  effects  of  random  on  capacity  to  be  understood  quantitatively  -  and 
we  are  back  to  our  third  principle. 

In  the  light  of  these  principles,  two  extreme  formulations  of  the  concept  of  capacity 
are  appropriate:  (1)  a  single  number',  and  (2)  a  transformation  of  a  demand  profile  into  a 
service  profile: 

(1)  For  a  minimum  acceptable  standard  of  service,  the  capacity  C  is 
the  maximum  mean  rate  of  service  (number  of  aircraft  handled  per 
unit  time)  that  can  be  rendered  when  the  rate  of  requests  is  itself 
uniform.  Tliis  notion  corresponds  to  a  steady-state  condition. 

(2)  Again  given  a  minimum  standard  of  service,  let  the  demand  profile 
D(t)  be  given.  The  system  in  question  will  then  supply  a  service  at 
the  mean  rate  of  S(t)  (aircraft  per  unit  time,  plotted  against  time 
of  day  t).  Remember  that  D(t)  and  S(t)  are  functions  of  many 
variables,  although  they  are  very  simply  described  by  symbols.  The 
correspondence  between  the  demand  D(t)  and  the  service  S(t), 
subject  to  the  constraint  that  the  standard  of  service  is  no  worse 
than  the  allowable  minimum  standard,  symbolically  represented 
by 
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{  D(t)  —  S(t), 

r  (C) 

(■ 

i  describes  how  the  system  accomplishes  this  demanded  task.  It  may 

■  be  compared  to  the  “transfer  function”  of  an  electrl  j  input-output 

(  system.  Moreover,  if  D(t)  is  the  greatest  demand  that  can  be 

handled  at  an  accepted  minimum  standard  of  service,  that  is,  if 
any  proportional  increase  (replacir»g  D(t)  by  (l■^h)D(t),  h>0) 
will  result  in  a  failure  to  meet  the  service  standard,  then  D(t)  is  the 
capacity  of  the  system.  Unfortunately,  because  D(t)  is  a  function 
;  of  many  variables,  many  different  values  of  D(t)  fulfill  this  con- 

■  dition.  The  definition  of  capacity  is  not  complete  until  all  values 

of  D{t)  satisfying  the  condition  have  been  described.  As  a  matter 

.  of  expediency,  ^  is  often  easier  simply  to  describe  the  transfor¬ 

mation  in  the  form  D(t)  -♦  S(t)  =  CD(t).  This  then  is  the  precise 
rendering  of  the  concept  of  capacity. 

Definition  (1)  is  simple  and  has  many  uses.  It  is  predicated  upon  the  assumption  of  a 
steady  state  or  representing  a  fluctuating  demand  by  averages  —  yearly,  daily,  busy  hour,  or 
whatever.  Therefore,  it  may  represent  departure  from  reality.  For  limited  parts  of  the  air 
transportation  system,  where  the  auxiliary  conditions  may  be  easy  to  detail,  such  a  defini¬ 
tion  may  be  quite  appropriate.  For  example,  Blumstein’s  definition  of  the  saturation  landing 
capacity  of  a  single  runway  is  of  this  type. 

The  second  definition,  involving  a  multi-parameter  transformation,  is  the  only  general 
and  precise  definition,  but  it  is  difficult  to  use.  In  the  first  place,  “minimum  standard  of  ac¬ 
ceptable  performance”  must  be  specified.  The  specification  requires  many  variables,  and 
some  of  the  variables  (for  instance,  noise)  are  far  removed  from  the  principal  area  of  activity 
of  the  ATC  service.  Also,  agreement  on  service  standards  is  not  unanimous,  because  dif¬ 
ferent  interest  groups  will  put  different  weights  on  various  service  degradations.  Moreover, 
attitudes  toward  acceptability  may  change.  For  instance,  the  proportion  of  flights  cancelled 
:  on  account  of  weather  which  was  acceptable  in  1960  may  be  considered  unacceptable  in 

1980,  or  an  amount  of  environmental  noise  around  an  airport  which  is  unacceptable  under 
general  conditions  may  be  conadered  acceptable  if  the  suffering  public  believes  a  temporary 
crisis  exists. 

j  A  second  problem  is  that  the  standard  of  acceptable  performance  relates  to  the  per¬ 

formance  of  the  air  transportation  system  as  a  whole,  not  to  the  performance  of  air  traffic 
'  control  alone,  or  to  the  performance  of  one  element  of  the  system.  For  example,  in 

examining  the  effect  of  delay,  we  may  distinguish  between  delays  on  the  ground  and  delays 
in  the  air,  for  the  latter  are  more  costly  to  the  airlines;  and  we  may  distinguish  between  pre¬ 
dictable  delays  and  delays  which  occur  unpredictably;  the  former  may  be  less  costly  to  a 
passenger.  On  the  other  hand,  whether  a  particular  delay  occurred  in  departure,  en  route,  or 
in  arrival,  or  whether  it  took  the  form  of  a  slowdown,  or  diversion  en  route,  or  circling  in  a 
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holding  pattern  is  relatively  unimportant  to  the  overall  evaluation.  The  conversion  of  a 
standard  of  overall  system  performance  into  standards  for  the  performance  of  various  sub¬ 
systems  and  elements  is  very  difficult.  There  are  many  ways  to  budget  a  total  margin  among 
many  contributing  factors,  but  they  do  not  all  lead  to  the  same  capacity. 

Finally,  the  demand  profile  is  a  function  of  many  parameters  also,  not  a  single  number. 
Gradual  changes,  such  as  progressive  changes  in  the  mix  of  aircraft  from  small  propeller- 
driven  aircraft  to  large  jets,  can  be  accommodated  by  correspondingly  small  evolutionary 
changes  in  the  transfer  function  C.  However,  the  introduction  of  VTOL  and  STOL  aircraft, 
for  instance,  might  require  a  complete  reanalysis. 

Defining  capacity  as  a  single  number  is  too  naive  to  be  useful,  and  defining  capacity  in 
terms  of  a  complete  transfer  function  is  too  complex  to  be  applicable  to  anything  but  philo¬ 
sophical  discussion.  We  believe  it  will  be  necessary,  in  general,  to  specialize  and  simplify  the 
general  definition  for  each  major  application  rather  than  to  attempt  an  exhaustive  universal 
definition. 

4.2  A  MEASURE  OF  SAFETY 

Peter  Drucker  has  said,  “. . .  we  mistakingly  think  that  one  can  live  in  a  riskless  uni¬ 
verse,  that  one  can  somehow  deprive  human  action  of  risk.  To  believe  that  one  can  be  (com¬ 
pletely)  safe  is  sheer  delusion.  The  real  challenge ...  is  to  think  through  what  risks  to  afford 
and  what  risks  are  not  permissible  and  where  to  draw  the  line,  and  what  price  to  pay  for 
what  degrees  of  insurance  ...  the  moment  you  want  to  be  liskless,  you  are . . .  vulnerable  to 
the  wrong  catastrophes.” 

It  is  interesting  that  Drucker’s  statement  (from  a  paper  “Why  We  Are  Not  Making 
Much  Progress”)  concerned  preserving  the  environment,  but  what  he  says  is  equally  true  of 
air  traffic  control.  One  of  the  impediments  to  a  rational  discussion  of  safety  has  been  lack  of 
a  measure  which  can  be  applied  equally  well  to  air  transportation  and  to  other  human  activi¬ 
ties.  We  have  found  a  new  measure  of  safety  in  the  literature*  and  applied  it  to  air  traffic 
control.  Starr  introduces  the  ratio  fatalities  per  hour  of  exposure,  and  shows  why  it  is  a  use¬ 
ful  unit.  In  studying  air  traffic  control,  this  unit  has  a  number  of  advantages. 

The  first  advantage  of  fatalities  per  hour  of  exposure  as  a  unit  for  the  measurement  of 
safety  is  that  it  makes  air  transportation  risks  easy  to  compare  with  other  risks.  The  problem 
in  defining  the  measure  of  risk  is  to  find  the  right  normalization  factor.  Everybody 
understands  what  a  fatality  is,  but  with  different  normalization  factors  we  can  generate 
fatalities  per  passenger  mile,  fatalities  per  hundred  million  population,  fatalities  per  million 
take-offs,  and  a  number  of  different  units.  Time  is  an  advantageous  normalizaton  factor 
because  the  flow  of  time  i/an  experience  common  to  all  human  beings.  The  time  spent  in 
any  human  activity  can  be  measured,  and  serves  as  a  common  denominator  for  comparing 
risks. 


In  particular,  when  risk  is  measured  in  terms  of  fatalities  per  hour  of  exposure,  man¬ 
made  risks  can  be  compared  with  the  risk  of  death  from  natural  causes.  As  Starr  shows,  the 
risk  of  contracting  a  fatal  disease  and  dying  from  it  is  around  1  in  a  1 ,000,000,  ranging  from 
1  in  10,000,000  for  healthy  young  people  to  1  in  a  100,009  and  more  for  the  elderly.  A 
corollary  of  this  is  that  risk  as  smal*  as  1  fatality  per  10,000,000  hours  of  exposure  cannot 
change  the  life  expectancy  pattern  of  a  large  group  of  people  very  much.  At  this  level,  the 
risk  of  death  from  a  cause  other  than  disease  is  extremely  small.  Further  reduction  of  a 
man-made  risk  below  the  level  of  1  per  10,000,000  hours  of  exposure  simply  serves  to  de¬ 
crease  the  already  small  probability  that  death  will  occur  by  other  than  natural  causes, 
without  having  an  appreciable  effect  on  the  total  fatality  rate. 

Is  it  true  that  a  risk  smaller  than  1  fatality  per  10,^30,000  hours  of  exposure  is  small  in 
a  social  sense  as  well  as  in  an  actuarial  sense?  Starr’s  evidence  shows  relations  between  the 
amount  of  risk  (measured  in  these  units)  and  the  proportion  of  a  population  which  is  willing 
to  participate  in  the  risk-producing  activity,  and  between  the  amount  of  risic  and  the 
amoum  of  benefit  which  people  expert  to  receive  from  partaking  of  the  risk-producing  ac¬ 
tivity.  For  voluntary  risks  -  activities  where  people  have  a  real  choice  about  whether  to  ex¬ 
pose  themselves  to  risk  or  not  -  when  the  risk  level  is  well  below  1  per  1 ,009,000  hours  of 
exposiu-e.  a  very  large  proportion  of  the  population  is  willing  to  expose  itself  for  a  small  per¬ 
ceived  gain.  At  levels  around  1  in  1 ,000,000,  a  small  proportion  of  the  population  exposes 
itself  in  sporting  activities,  such  as  hunting,  for  a  modest  perceived  gain,  and  most  people  in 
this  country  expose  themselves  to  riding  in  automobiles  at  this  risk  level  for  a  large  per¬ 
ceived  gain,  even  though  the  absolute  dealth  toll  from  automobile  traffic  fatalities  is  around 
50,000  per  year  for  the  whole  country.  Any  risk  which  is  substantially  higher  than  1  per 
1,000,000  hours  of  exposure,  such  as  the  risk  of  non-professional  general  aviation,  is  likely 
io  be  considered  dangerous,  with  limited  participation  even  when  the  perceived  gain  may  be 
high.  In  these  terms,  therefore,  this  measure  of  safety  is  a  useful  and  convenient  medium  for 
discussing  acceptability  and  unacceptability. 

As  long  as  the  design  requirement  is  no  risk,  many  trades  and  optimizations  which 
ought  to  be  carried  out  are  eliminated  completely.  For  example,  we  know  that  exposure  to 
near  misses  increases  with  terminal  air  congestion,^  and  we  infer  therefore,  that  the  risk  of 
mid-air  collision  in  a  terminal  area  increases  as  the  amount  of  traffic  in  the  air  increases.  Part 
of  the  terminal-area  traffic  results  from  queueing  for  landing,  and  is  therefore  influenced  by 
runway  acceptance  rate  of  the  terminal.  The  in-air  queue  could  be  decreased  by  decreasing 
the  minimum  separation  standard  in  the  final  glide  path.  However,  such  an  action  would 
probably  increase  the  landing  risk.  It  is  reasonable  to  ask  the  question:  What  landing  pro¬ 
cedure  minimizes  the  joint  risk  of  terminal  area  mid-air  collision  and  final  landing?  To  the 
best  of  my  knowledge,  this  question  has  never  been  examined  quantitatively.  It  is  extremely 
difficult  to  examine  until  a  unit  of  safety  has  been  adopted,  and  until  we  understand  the 
usefulness  of  deliberately  increasing  the  risk  in  one  part  of  the  system  in  order  to  achieve  an 
even  greater  reduction  in  risk  in  another  part. 


(  Another  advantage  of  this  measure  of  safety  is  its  usefulness  in  establishing  practical 

E  safety  goals.  This  is  discussed  at  length  in  another  report.^  Some  of  these  ideas  have  already 

f  been  used  by  Mr.  Bravemian  of  NAFEC.'* 

Although  the  concept  of  an  acceptable  risk  is  repugnant  to  many,  we  will  show  a  little 
bit  of  evidence  that  an  acceptable  risk  level  is  already  achieved.  Figure  4. 1  (reproduced  from 
one  of  our  recent  reports® )  shows  the  number  of  fatal  accidents  versus  regular  hours  flown 
for  U.S.-certified  air  carriers  in  scheduled  passenger  service  for  the  12  years  from  1956 
through  1967.  These  points  are  plotted  on  a  special  paper  with  a  rather  particular  set  of  co¬ 
ordinate  axes.*  A  distinctive  property  of  the  paper  is  that,  for  binomial  and  Poisson  distri¬ 
butions,  a  dispersion  of  one  standard  deviation  has  the  same  physical  dimension  on  any  part 
of  the  coordinate  paper.  Therefore,  deviations  from  a  constant  mean  rate  of  plus  or  minus 
one  or  two  standard  deviations,  are  represented  schematically  by  a  family  of  parallel  lines,  as 
on  the  figure.  If  these  accidents  were  all  statistically  independent,  the  number  experienced 
in  each  year  would  be  samples  from  a  Poisson  distribution.  With  12  sample  points  plotted 
on  this  scale  as  unit  line  segments,  we  could  expect  approximately  4  to  lie  entirely  outside 
of  the  plus  or  minus  one  standard  deviation  limits  and  would  expect,  with  about  50%  prob¬ 
ability,  that  one  would  lie  outside  of  the  plus  and  minus  two  standard  deviation  limits.  As  a 
matter  of  fact,  none  fall  outside  of  the  two  standard  deviation  limits  and  only  one  falls  out¬ 
side  of  the  one  standard  deviation  limits. 

This  suggests  that  accidents  are  not  statistically  independent  but  that  their  occurrence 
is  more  regular  than  a  totally  landom  Poisson  series.  In  lay  terms,  immediately  after  an 
accident  has  occurred  the  probability  of  a  second  one  appears  to  decrease,  but  after  a  while 
the  probability  rises  again  to  its  former  level.  The  clustering  of  the  points  on  the  figure  is 
not  so  tight  as  to  be  statistically  convincing:  the  probability  of  this  degree  of  clustering 
occurring  by  chance  among  1 2  points  is  over  5%,  and  few  statisticians  would  accept  the  con- 
cluaon  of  this  degree  of  importance  even  at  a  5%  confidence  level.  On  the  other  hand,  from 
the  point  of  view  of  controlling  safety  as  a  parameter,  the  safety  of  U.S.-certified  air  carriers 
certainly  was  not  “out  of  control”  during  this  period  of  time,  and  a  rapid  growth  of  pas¬ 
senger  traffic  during  this  period  attests  to  a  certain  kind  of  social  acceptability  of  this  degree 
of  risk  in  exchange  for  the  high  economic,  social,  and  military  value  of  intercity  air  pas¬ 
senger  transportation. 

4.3.  SOME  ANALYTICAL  TOOLS  FROM  THE  THEORY  OF  QUEUES 

Inasmuch  as  our  work  on  analytical  tools  has  been  reported  in  detail  recently,’  we 
shall  merely  summarize  it  briefly  here.  Queue  theory  has  been  used  extensively  in  the  past, 
j  but  it  has  been  applied  to  air  traffic  control  chiefly  in  terms  of  st  rady-state  queueing  anal- 

i  ysis  or  in  terms  of  compute.-  emulation.  Neither  of  these  is  adequate  for  analysis  of  ATC 

system  capacity.  Computer  simulation  without  parallel  analysis  is  deficient,  because  one  can 
I  never  be  certain  whether  a  particular  computer  result  is  typical  or  an  accidental  extreme, 

I  and  the  generation  of  eno  gh  computer  results  to  describe  distributions  is  usually  pro- 

1  hibitively  expensive. 
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Steady-state  analysis  is  inadequate  because  of  the  importance  of  dynamic  and  t'm- 
sients  in  ATC  problems.  Both  the  demand  for  service  and  the  rate  at  which  the  service  can 
be  rendered  fluctuates  with  time.  If  these  fluctuations  were  very  slow  compared  with  transit 
times  and  queue  delay  times  in  the  system,  we  could  represent  the  system  at  only  one 
moment  as  being  nearly  in  its  steady  state  and  use  steady-state  statistics.  Or  conversely,  if 
the  fluctuations  were  extremely  rapid  when  compared  with  both  queue  delay  and  transit 
times,  then  one  could  average  the  demand  and  service  fluctuations  to  generate  queue  sta¬ 
tistics  based  on  average  demands  and  service  rates.  However,  the  typical  time  over  which  de¬ 
mand  and  service  rates  fluctuate  is  neither  very  much  larger  nor  very  much  snraller  than  the 
typical  transit  times  and  delay  times:  queue  delay  times  may  run  from  a  fraction  of  a 
minute  to  an  hour  or  more;  transit  times  may  run  from  20  minutes  to  several  hours;  rush 
hour  peak  loads  can  build  up  from  a  very  lightly  loaded  prepeak  state  to  a  peak  overload 
within  30  minutes;  and  a  weather  change  may  cause  an  abrupt  change  in  the  servite  rate  of  a 
sector  or  a  terminal  within  a  few  minutes.  In  fact,  the  dynamics  of  the  building  up  and 
decay  of  queues  are  much  more  important  in  ATC  system  capacity  analysis  than  any 
steady-state  values. 

One  of  the  first  important  theoretical  facts  we  proved  is  the  existence  of  a  unique 
periodic  solution  whenever  demand  and  service  rate  functions  are  periodic.  .Although  often 
assumed,  this  should  not  have  been  accepted  without  proof.  The  differential  equations  of  an 
electrical  network  superficially  resemble  those  which  describe  multiple  queues.  Periodic 
variation  of  the  coefficients  of  an  electrical  network  can  produce  modulators  and  parametric 
amplifiers  which  exhibit  unstable  and  nondeterministic  behavior.  The  constraints  and 
boundary  conditions  on  queues  prevent  that  kind  of  instability.  This  means,  for  example, 
that  a  24-hour  periodic  set  of  demand  and  service  conditions  can  be  used  as  a  realistic 
example  of  a  non-time  invariant  problem  with  unique  stable  solutions. 

We  have  also  shown  that  many  important  queue  parameters  are  insensitive  to  service 
statistics.  We  devek  -jd  some  numerical  examples  of  a  single-server  queue  based  on  the  de¬ 
mand  function  shown  by  the  darker  line  on  Figure  4.2.*  This  curve  represents  the  average 
combined  demand  for  landings  and  take-offs  at  LaGuardia  Terminal  for  one  month  in  1968, 
and  it  is  therefore  representative  of  a  kind  of  demand  variation  which  actually  exists  in  the 
air  transportation  system.  Figures  4.3  and  4.4  show  a  number  of  computed  queue  parameters 
based  on  a  single-seivcr  queue  with  a  service  rate  of  55  per  hour.  The  significant  curves  are 
those  represented  by  solid  lines,  labelled  “constant  service  time,”  and  dash  lines,  labelled 
“random  (Poisson)  service  rate,  /x=  1  /c.”  This  significance  is  as  follows: 

In  every  instance  ’'e  assumed  tlu.*  the  demand  is  «  i-andom  Poisson  series,  the  mean 
parameter  of  which  isrepresented  by  the  time-varying  curve  on  Figure  4.2.  “Constant  service 


*This  and  U»e  next  two  figures  are  figures  4-1.  4-10.  and  4-11,  respectively  of  report  FAA-RD-71-55 
(Ref.  7). 
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FIGURE  4.2  HOURLY  ARRIVAL  RATES  -  TERMINALS  A  AND  B 
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time”  means  that  each  unit  served  occupied  the  system  for  exactly  the  same  time,  1/55  of 
an  hour  or  65.45  seconds,  no  more  and  no  less.  This  is  an  extreme  assumption  about  service 
time,  more  regular  than  can  ever  occur  in  real  life.  “Random  (Poisson)  service  rate, 
means  that  the  service  times  were  drawn  from  an  exponential  distribution  with  a  mean  value 
of  65.45  seconds.  Such  a  distribution  is  actually  the  most  random  distribution  consistent 
with  having  a  mean  value,  and  service  times  of  all  durations  from  0  to  many  times  65.45 
seconds  occur  with  substantial  probability.  This  is  much  more  non-uniform  than  any  real 
terminal  area  service  time  distribution  could  become. 

The  significance  of  these  computations  is  that  the  solid  curve  and  the  dashed  curve  are 
not  very  much  separated  on  these  four  charts.  In  fact  the  expected  number  in  the  queue 
(which  is  very  closely  related  to  the  waiting  time),  the  standard  deviation  of  the  number  in 
the  queue,  the  probability  that  the  queue  is  empty  and  the  probability  that  the  queue  is  full 
differ  very  little  under  the  two  assumptions.  Comparing  the  expected  number  in  the  queue 
with  the  standard  deviation  of  the  number  in  the  queue  (Figures  4.3  and  4.4),  one  can  easily  see 
that  the  difference  between  the  expected  values  under  the  two  service  time  assumptions  is 
considerably  smaller  than  the  standard  deviation  of  either  one.  Therefore,  if  a  field  experi¬ 
ment  or  a  computer  simulation  were  carried  out,  one  would  expect  the  random  fluctuations 
to  be  considerably  greater  than  the  difference  between  the  curves  resulting  from  the  two 
assumptions. 

A  practical  consequence  of  this  discovery  is  that  we  can  choose  the  mathematical 
representation  of  server  behavior  in  a  way  which  is  computationally  convenient,  rather  than 
trying  to  represent  realism  in  this  detail  of  model  behavior.  For  some  purposes,  the  Poisson 
service  assumption  is  extremely  tractable  mathematically,  but  others  may  be  favored  in 
other  circumstances. 


We  have  also  begun  to  apply  ensemble  statistics  and  perturbation  methods  to  multiple- 
queue  atuations.  In  a  queueing  model  an  interconnected  complex  of  runways,  arrival  and 
departure  zones,  and  en  route  sectors  involves  a  large  number  of  queues,  each  one  of  which 
feeds  and  is  fed  by  others.  A  complete  description  of  the  state  of  the  system  would  require  a 
description  of  the  state  of  each  queue,  and  the  total  number  of  states  is  the  product  of  the 
maximum  queue  lengths  of  all  the  queues  in  the  system.  This  number  of  joint  states  is  very 
large,  and  to  base  an  analysis  or  computation  on  such  a  model  is  probably  uneconomical, 
even  if  it  were  possible.  On  the  other  hand,  in  many  problems  in  mathematical  physics, 
weakly  coupled  systems  have  beer,  handled  by  writing  the  differential  equations  of  each  sub¬ 
system  (in  our  case,  each  indiv'dual  queue)  in  detail,  and  describing  their  interactions  by 
letting  the  coefficients  of  each  differential  equation  be  funcrions  of  average  behavior  of  all 
of  the  other  queues.  We  are  working  out  a  sample  example  involving  two  queues,  and  simul¬ 
taneously  comparing  the  efficiency  of  several  different  computational  methods  for  solving 
the  resulting  differential  equations  in  order  to  find  out  that  which  is  the  most  economical. 
We  expect  to  show  very  soon  that  this  is  a  practical,  economical,  and  useful  approximation 
for  representing  multiple  air  queues. 
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j  4.4  ANALYSIS  OF  SYSTEM  FUNCTIONS  AND  A  DESCRIPTION  OF  SYSTEM 
I  PARAMETERS 

f 

f  4.4, 1  Analysis  of  the  ATC  System  by  Functions 

I 


•  We  view  the  ATC  system  as  an  information  processing  (sensing,  processing,  storage,  and 

I  display)  and  decision-making  system  providing  feedback  control  systems  to  aircraft  and 

I  other  elements  of  the  whole  air  transportation  system.  A  year  ago  we  undertook  to  make  a 
complete  description  of  the  ATC  system  in  these  terms  in  order  to  provide  a  framework  for 
i  further  quantitative  studies.  We  have  identified  the  gross  feedback  loops  involved  in  in-air 

;  separation  (but  have  never  reported  this  work  in  formal  reports).  For  the  time  being  we  have 

set  this  work  aside,  because  we  found  it  more  important  to  list  and  describe  system  param¬ 
eters  and  operating  constraints  which  appeared  to  have  a  direct  effect  on  ATC  system  or 
subsystem  capacity. 

4.4.2  Description  of  Parameters  Relating  to  Capacity 

A  report*  describing  a  large  number  of  system  parameters  and  operating  strengths 
affecting  capacity  has  been  published  just  recently.  This  report  classifies  over  70  types  of  in¬ 
fluence  on  ATC  system  capacity  and  relates  them  to  each  other.  Certain  characteristics  and 
qualities  stand  out  because  of  their  great  and  intrinsic  importance,  and  numerous  relations 
to  other  capacity-related  characteristics.  These  are: 

•  Smaller  separation  minima,  smaller  tolerances  and  margin,  higher 
precision,  and  rapid  responses; 

•  Controller  workload; 

•  Regularization  of  flow  and  responses  to  peak  and  statistical 
fluctuations: 

•  Interface  management;  and 

j  •  Diversification. 

S 

i  Minima,  tolerances,  margins,  p:''  vision,  and  response  time  are  important  because  they 

i  have  a  first-order  effect  on  the  saturation  capacity  of  a  number  of  subsystems.  Controller 

j  workload  is  bound  to  be  an  important  capacity  limitation  for  economic  reasons.  Air  traffic 

j  control  is  labor-intensive.  A  very  large  proportion  of  the  total  cost  of  air  traffic  control  is  in 

I  controllers’  salaries  and,  therefore,  good  management  of  the  system  requires  adaptation  of 

I  the  work  pattern  so  that  most  controllers  are  busy  most  of  the  time.  Flow  regularization 

I  and  response  to  statistical  fluctuations  are  important  because  they  determine  how  close  to 

I  complete  the  system  may  be  operated  before  service  degradations  are  unacceptable.  Inter- 

I  face  management  arises  in  a  number  of  ways,  for  example,  in  the  proliferation  of  hand-off 
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1  operations  required  if  an  attempt  is  made  to  increase  the  system  capacity  by  greatly  in¬ 

creasing  the  number  of  sectors.  Providing  alternate  functional  means  of  carrying  out  various 
[  functions  in  the  air  transportation  system  has  the  effect  of  supplying  non-competitive  or 

I  non-interfering  resources  which  may  work  together  to  increase  productivity. 

i 

I  These  five  categories  of  characteristics  and  qualities  influencing  capacity  are  of  primary 

;  importance,  not  only  for  their  first-order  effects  but  because  nearly  all  of  the  other  qualities 

!  and  characteristics  which  appear  to  influence  capacity  affect  one  or  more  of  these  five  cate- 

I  gories  also. 

c 

I  This  work  will  be  set  forth  in  more  detail  in  our  forthcoming  report. 

I  4.5  APPLICATIONS  TO  CERTAIN  CURRENT  FAA  PROBLEMS 

I 

i 

i  The  purpose  of  all  this  work  is  to  provide  technical  tools  which  will  be  useful  to  people 

I  in  the  FAA  responsible  for  making  technical  and  management  plans  concerning  ATC  system 

capacity.  The  validity  and  usefulness  of  tools  under  development  can  only  be  judged  by 
practical  application.  Therefore,  we  are  devoting  an  increasing  amount  of  effort  to  particular 
applications  of  capacity  analysis  tools.  This  section  is  devoted  to  a  review  of  some  of  these 
applications. 

We  have  already  alluded  to  one  of  our  reports.  An  Approach  to  the  Establishment  of 
Practical  Aii  Traffic  Control  Safely  Goals.^  The  purpose  of  this  report  was  to  demonstrate 
the  utility  of  the  measure  of  risk  described  in  a  previous  section  by  using  it  as  the  basis  for  a 
method  of  setting  safety  goals.  This  report  shows  how  a  knowledge  of  the  incidence  of  fatal 
aircraft  accidents  in  the  recent  past  can  be  combined  with  an  estimate  of  the  overall  risk  in 
various  types  of  human  activity,  which  have  been  found  socially  acceptable,  to  produce 
r;  lional,  quantitative  goals  for  the  risk  associated  with  air  traffic  control.  Fatal  accidents 
over  an  8-year  period,  from  1961  to  1968  inclusive,  are  categorized  in  36  groups  based  on  6 
phases  of  flight  and  6  type-cause  categories.  The  improvement  in  overall  air  transportation 
safety  which  could  be  achieved  by  reducing  or  eliminating  all  sources  of  accident  which  are, 
in  any  way,  related  to  air  traffic  control  is  examined.  Inasmuch  as  the  majority  of  fatalities 
cannot,  by  the  most  generous  reckoning,  be  associated  with  air  traffic  control,  the  total  pos¬ 
sible  improvement  is  not  impresave.  When,  on  the  other  hand,  proportional  reduction  in 
risk  from  all  causes  is  assumed,  a  set  of  mutually  compatible  risk  goals  for  each  of  the  36 
groups  can  be  stated.  The  report  concludes: 

*  (1)  The  content  and  quantity  of  available  data  are  sufficient  for  this 

■  process  to  be  onied  out; 

i  (2)  The  incidence  of  various  classes  of  accidents  is  consistent  with  the 

» 

use  of  fatality  per  hour  of  exposure  as  a  unit  of  measurement,  assd 
with  the  assumption  of  statistical  independence  among  accidents 
over  a  moderate  period  of  time; 


(3)  Passenger  and  crew  risk,  in  tliese  units,  can  be  reduced  to  levels 
characteristic  of  other  human  activities  perceived  as  ‘‘negligibly 
risky”  only  if  sources  of  risk  totally  outside  air  traffic  control  are 
substantially  reduced,  as  well  as  risks  with  a  possible  relation  to  air 
traffic  control;  and 


(4)  The  number  of  incidents  implied  by  the  resulting  safety  targets  is 
so  small  that  indirect  rather  than  direct  estimation  of  safety  per¬ 
formance  would  be  required  to  validate  any  attempts  to  achieve 
them. 


We  have  also  alluded  to  the  insensitivity  of  the  behavior  of  certain  types  of  queues  to 
server  statistics.  The  same  principles  can  be  applied  to  analysis  of  the  effects  of  average 
service  rate,  metering,  and  flow  control.  Whereas  server  statistics  are  of  relatively  low  sen¬ 
sitivity  in  typical  queue  formulations,  the  average  service  rate  is  of  major  importance.  Meter¬ 
ing  affects  the  statistics  of  the  demand  of  stream,  but  not  the  average  rate.  Flow  control, 
which  may  influence  time  spans  longer  than  those  influenced  in  metering,  may  affect  short¬ 
term  demand  averages,  but  not  the  average  rate.  Flow  control,  which  may  influence  time 
spans  longer  than  those  influenced  in  metering,  may  affect  short-term  demand  averages,  but 
not  long-term  demand  averages.  Neither  metering  nor  flow  control  affects  average  service 
rates.  We  have  discussed’*  a  number  of  implications  of  these  facts.  In  general,  attempts  to  in¬ 
fluence  capacity  by  metering  will  affect  the  characteristics  of  queues  operated  at  air  satura¬ 
tion  throughput,  with  delay  reductions,  but  only  at  the  expense  of  instability.  If  the  de¬ 
mand  temporarily  exceeds  the  saturation  service  rate,  the  dynamics  of  queue  buildup  is 
relatively  unaffected  by  metering.  If  flow  control  can  be  carried  out  over  a  sufficient  time 
span,  so  that  the  short-term  demand  never  exceeds  the  service  rate,  the  full  effectiveness  ->f 
metering  and  other  peak  smoothing  measures  can  be  reaped.  However,  this  is  only  a  partial 
solution,  for  flow  control  solves  the  problem  only  by  denying  or  delaying  access  to  the  air 
cra.isportation  system  for  some  users.  None  of  these  can  be  compared  in  effectiveness  with 
measures  which  actually  increase  the  situration  throughput,  such  as  making  more  runways 
and  adding  sectors.  The  latter  measures  not  only  increase  the  saturation  productivity,  but 
decrease  the  senativity  of  the  system  to  perturbations  in  demand  and  service  level. 


In  an  earlier  report^  **  we  referred  to  the  fact  that  mid-air  collisions  involving  sched¬ 
uled  carrier  aircraft  are  extremely  infrequent,  so  infrequent  that  the  effectiveness  of  moder¬ 
ate  safety  improvements  cannot  practically  be  estimated  from  mid-air  collision  statistics 
alone.  Wc  proposed  a  model  of  mid-air  collision  which  could  be  tested  by  instrumenting  a 
substantial  part  of  the  scheduled  air  carrier  fleet  with  measurement  instruments  which 
would  measure  distance  of  closest  approach  to  other  aircraft  out  to  a  range  of  200  yards  or 


*  As  well  as  numerous  contacts  with  FAA  personnel. 
•See  5.4. 
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so.  The  model  would  be  such  that  if  it  were  validated  by  experiment,  indirect  measurement 
of  the  risk  of  mid-air  collision  could  be  made  with  1000  times  less  operating  experience  than 
required  if  only  actual  collisions  provided  data.  This  suggestion  has  never  been  acted  upon 
by  the  FAA,  probably  for  practical  and  economical  reasons.  It  remains  as  an  example  of  a 
type  of  data  enrichment,  indirect  measurements,  and  non-destructive  testing  which  we  be¬ 
lieve  should  be  emphasized  in  the  FAA’s  treatment  of  safety  as  a  parameter  affecting  ATC 
system  capacity. 

Shortly  before  the  new  Chicago  Tower  was  put  into  use  in  the  summer  of  1971,  we 
proposed  a  method  of  direct  comparison  between  manual  and  automated  procedures  based 
on  the  observation  that  O’Hare  airport  is  normally  operated  with  two  independent  sets  of 
arrival  and  departure  controllers,  with  each  runway  assigned  uniquely  to  one  or  the  other  set 
of  controllers.  That  is,  under  most  conditions  the  airport  is  operated  as  two  separate  airports 
which  happened  to  be  laid  out  on  the  same  plot  of  land.  Our  proposal  was  to  operate  one 
part  manually  and  the  other  part  with  automation,  with  a  balanced  experimental  design  to 
average  out  most  of  the  secular  variables.  Unfortunately,  we  made  this  proposal  too  late  to 
be  of  any  use  to  the  FAA.  However,  we  believe  it  represents  a  type  of  thinking  that  could  be 
used  to  advantage  later  if  supported  by  sufficient  advanced  planning.  This  would  provide  a 
much  more  accurate  measurement  of  the  effectiveness  of  terminal  automation  than  any 
which  have  been  previously  attempted. 

Last  June,  the  Air  Transport  Association  sent  us  a  brief  report  on  the  problem  of 
system-effectiveness  measurement.  It  was  prepared  by  their  airline  system-effectiveness 
measurement  working  group  in  anticipation  of  somewhat  more  formal  relationships  with  the 
FAA.  Since  that  time,  the  FAA  has  responded  by  designating  a  group  of  people  to  work 
with  the  Air  Transport  Association  in  resolving  some  of  the  issues  raised  in  the  ATA 
memorandum.  We  have  been  asked  to  support  the  FAA  in  preparing  a  position  and  respond¬ 
ing  to  the  real  needs  of  the  using  public. 

The  substance  of  our  initial  opinion  can  be  summarized  as  follows.  The  data  require¬ 
ments  for  research,  development,  and  investment  decisions  are  determined  by  the  analytical 
models  from  which  effectiveness  is  estimated.  These  analytical  models  are  based  upon  a  de¬ 
tailed  understanding  of  the  system  and  the  interaction  of  its  components  which  consist  of 
both  men  and  machines.  Some  of  the  most  vital  data  needed  can  probably  best  be  obtained 
by  special  tests  suggested  by  the  analyst  rather  than  by  an  omni-purpose  approach.  Such  an 
approach  may,  however,  have  value  in  revealing  certain  unsuspected  factors  affecting  delay. 
Suspected  factors,  such  as  weather,  runway  conditions,  demand  patterns,  etc.,  are  already 
understood,  but  additional  statistics  regarding  them  will  be  of  considerable  importance.  The 
ATC  system  operates  as  a  multiply  compensated,  highly  buffered  feedback  system  in  which 
delay  is  one  of  the  least  costly  penalties  for  sj'stem  overload.  Therefore,  delay  will  be  a 
sensitive  index  of  the  degree  of  loading  of  the  system,  but  probably  a  very  poor  diagnostic 
index  of  the  cause  of  the  loading. 
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After  a  discussion  with  members  of  the  FAA,  we  have  agreed  to  do  further  work  to  ex¬ 
plain  the  role  played  by  delay  in  a  multiple  queueing  system,  and  to  explain  the  distinction 
between  delays  which  are  an  accepted  or  even  desired  consequence  of  the  successful  opera¬ 
tion  of  the  control  system  from  delays  which  can  be  interpreted  as  the  result  of  a  system 
fault  or  inadequacy.  This  work  will  probably  not  be  reported  in  formal  reports.  It  will  be 
effective  when  it  is  directly  utilized  by  members  of  the  FAA  in  a  joint  approach  with  the 
ATA  to  some  of  the  issues  raised  in  the  ATA  subcommittee. 


t 

I 
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5.  PROPOSED  FUTURE  WORK 

The  general  objective  of  the  next  phase  of  our  work  is  to  de\elop  a  procedure  by  which 
the  FAA  can  assess  ATC  terminal  area  system  performance.  This  assessment  p-ocedure  is  to 
be  valid  for  use  on  the  current  system  to  monitor  and  to  detect  degradations  and  their 
causes.  It  should  also  be  capable  of  estimating  the  impact  of  proposed  future  improvements 
on  system  performance. 

Specifically  the  effort  is  to  provide  a  method  for: 

•  Measuring  and  defining  current  performances; 

•  Identifying  causal  factors  of  system  degradation  and  the  parts  of 
the  s>'stem  wliich  need  improvement. 

•  Providing  the  method  of  obtaining  the  data  base  needed  to  assess 
the  benefits  of  future  improvements;  and 

•  Defining  the  approach  to  be  taken  in  forecasting  the  potential 
benefits  of  improvements  for  a  busy  terminal  area. 

The  context  in  which  this  work  is  to  be  done  is  to  be  a  typical  major  hub.  but  the 
results  are  to  be  applicable  to  any  other  similar  area  as  well. 

5.1  APPROACH 


We  plan  to  use  the  Boston  Terminal  Area  for  our  initial  efforts.  Starting  from  an  opera¬ 
tional  description  of  the  area,  we  will  define  the  principal  subsystems  involved  and,  for  each 
of  these  systems,  we  will  develop  measures  of  performance  effectiveness,  the  operational 
parameters  upon  which  these  measures  depend,  and  the  analytical  relations  between  them. 
On  the  baas  of  criteria  which  reflect  relevance,  feaability,  etc.,  we  will  select  performance 
effectiveness  measures  which  best  meet  the  needs  of  the  FAA.  We  will  also  analyze  the 
sources  of  data  to  determine  which  are  most  suitable  as  a  basis  for  performance  estimation. 


5.2  RESULTS 


Our  principal  results  in  this  phase  of  the  work  are  expected  tc  be  as  follows; 

*  A  plan  for  a  data  collection  and  analysis  program  that  can  be  used 
by  the  Government  for  continuous  monitoring  of  a  busy  terminal 
area  by  means  of  suitably  defined  system  performance  measures, 
and  an  estimation  of  the  costs  for  such  a  ^stem; 
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An  evaluation  of  the  role  of  simulation  in  contributing  to  the 
forecasting  of  the  effects  of  new  equipment  or  procedures  upon 
the  system-performance  measures; 

An  analysis  of  the  system  delay  processes  to  develop  the  concept 
of  an  ATC  delay  and  its  elements;  and 

Using  available  data,  a  demonstration  of  effects  upon  the  appro¬ 
priate  performance  measures  of  improvements  in  terminal  area 
equipment  or  procedures. 
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